Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699054 source statements · aliases may refer to the same vulnerabilityMalicious code in epic-angular-ui-codemirror (npm)
osv ·
npm: epic-angular-ui-codemirror
Malicious code in epic-asset-uploader-ui (npm)
osv ·
npm: epic-asset-uploader-ui
Malicious code in epic-analytics-worker (npm)
osv ·
npm: epic-analytics-worker
Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)
osv · GHSA-pvq7-rm52-m5g7
npm: bnpl-blocks-atom-bnpl-search-input
Malicious code in @wizloft/harness-kernel (npm)
osv · GHSA-9f63-qfxp-2726
npm: @wizloft/harness-kernel
Malicious code in hardhat-hold (npm)
osv · GHSA-f33v-qqxm-m6m9
npm: hardhat-hold
Malicious code in @wizloft/harness-authority (npm)
osv · GHSA-8h24-fp89-4cw3
npm: @wizloft/harness-authority
Malicious code in @wizloft/harness-plugin-file-memory (npm)
osv · GHSA-64w5-qg43-54g7
npm: @wizloft/harness-plugin-file-memory
Malicious code in @wizloft/harness-plugin-file-events (npm)
osv · GHSA-6866-wx9h-j2rh
npm: @wizloft/harness-plugin-file-events
Malicious code in @wizloft/harness-evidence (npm)
osv · GHSA-mjfj-x5qx-p7v8
npm: @wizloft/harness-evidence
Malicious code in bigops-auth-interceptor (npm)
osv · GHSA-7pp9-3qqc-vc84
npm: bigops-auth-interceptor
Malicious code in @wizloft/harness-context (npm)
osv · GHSA-wjhv-xmmw-qqf9
npm: @wizloft/harness-context
Malicious code in @wizloft/harness-file-providers (npm)
osv · GHSA-2jrv-g43f-qm7f
npm: @wizloft/harness-file-providers
Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm)
osv · GHSA-vrh4-rf6w-3256
npm: bnpl-blocks-mobile-bnpl-floating-button
Malicious code in @wizloft/harness (npm)
osv · GHSA-hv3x-6r5c-g4cp
npm: @wizloft/harness
Malicious code in @wizloft/harness-project (npm)
osv · GHSA-xj44-gx57-mm59
npm: @wizloft/harness-project
Malicious code in bigops-products-timeline (npm)
osv · GHSA-9f9c-qwvh-f45q
npm: bigops-products-timeline
Malicious code in @wizloft/harness-commands (npm)
osv · GHSA-cv26-mq7q-h5hq
npm: @wizloft/harness-commands
Malicious code in @wizloft/harness-memory (npm)
osv · GHSA-3mjw-625p-wvhf
npm: @wizloft/harness-memory
Malicious code in evm-validation (npm)
osv · GHSA-gvxq-2rq2-f7x6
npm: evm-validation
Malicious code in devplatform-sdk (npm)
osv · GHSA-24m2-6frm-vxj3
npm: devplatform-sdk
Malicious code in @wizloft/harness-plugin-repository-files (npm)
osv · GHSA-p4gf-f4rj-hfh8
npm: @wizloft/harness-plugin-repository-files
Malicious code in agora402-payment-utils (npm)
osv · GHSA-pvr5-m9hx-xxfr
npm: agora402-payment-utils
Malicious code in @wizloft/harness-cli-adapter (npm)
osv · GHSA-hmmw-27v2-3qc8
npm: @wizloft/harness-cli-adapter
Malicious code in @wizloft/harness-plugin-memory-context (npm)
osv · GHSA-r4qq-8p58-gfpv
npm: @wizloft/harness-plugin-memory-context
Malicious code in @wizloft/harness-validation (npm)
osv · GHSA-7g98-grc6-6xjh
npm: @wizloft/harness-validation
Malicious code in @httttt/mcp-npx-fetch-1 (npm)
osv · GHSA-q6m6-3rfx-7f62
npm: @httttt/mcp-npx-fetch-1
Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy · https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy
Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12
cve-program ·
Vendor product: Archer AX53 v1.0 · Vendor product: Archer AX12 v1
Malicious code in n8n-nodes-data-transformer-utils (npm)
osv ·
npm: n8n-nodes-data-transformer-utils
Malicious code in tailwind-form-styles (npm)
osv · GHSA-h48r-xx59-h44r
npm: tailwind-form-styles
Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
cve-program ·
Vendor product: Enterprise Server
Unleash: CR-approval email renders user-controlled raw HTML
osv · CVE-2026-76909
npm: unleash-server
Unleash: Missing await on permission check + cross-project IDOR in admin API
osv · CVE-2026-77426
npm: unleash-server
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
osv · CVE-2026-77425
npm: unleash-server
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
osv · CVE-2026-75510
npm: @novu/js
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
osv · CVE-2026-76910
npm: unleash-server
`stack-graphs` C API exports are safe `extern "C"` functions
osv ·
crates.io: stack-graphs
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.